CVE-2026-68093

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug

If a vCPU stays scheduled out (or blocked) while the last pCPU it ran

on goes through a hotplug cycle (online->offline->online), and the vCPU

then resumes execution on the same pCPU, then it is possible for it to

run with an ASID that has now been assigned to a different vCPU,

resulting in stale TLB translations being used.

svm_enable_virtualization_cpu() resets asid_generation to 1 and sets

next_asid to max_asid + 1 on every CPU online event, including hotplug

cycles. Because next_asid starts beyond the pool boundary, the first

call to new_asid() after an online event always wraps the pool,

incrementing asid_generation to 2 and assigning ASIDs starting from

min_asid.

Consider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding

asid_generation=2 and ASID=N from before the hotplug event:

1. CPU-X goes offline and back onl

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References